Scope & impact
Think we missed something? DM @vladbochok.
Impact in scope
| Critical | Unauthorized asset movementA way to steal, redirect, or mint assets without permission. |
|---|---|
| Critical | Invalid proof or state acceptedA broken verification check that accepts an invalid proof or unauthorized state transition. |
| Critical | Emergency upgrade or immediate protocol riskAny bug that requires an emergency upgrade procedure, or puts user funds or protocol safety at immediate risk. |
| Critical | Remote code execution on running servicesA reproducible way to execute attacker-controlled code on a running service or production process. |
| High | Unauthorized access or privilegeBypassing access controls, crossing a tenant boundary, or performing a privileged action. |
| High | Era circuit implementation mismatchDifference between the implementation outside the circuit and within the circuit, where the in-circuit implementation is accurate—for example, an overconstraint in the circuit. |
| High | Private data or secret exposedEvidence that an attacker can read information they should not access. |
| Medium | Service or transaction disruptionA reproducible attack that prevents normal operation, with its reach and recovery conditions. |
| Medium | Misrepresentation of data on websitesA reproducible issue that causes a website to display materially incorrect or misleading data. |